@vibecheckai/cli 3.0.4 → 3.0.7

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (108) hide show
  1. package/bin/dev/run-v2-torture.js +30 -0
  2. package/bin/runners/context/index.js +1 -1
  3. package/bin/runners/lib/analyzers.js +38 -0
  4. package/bin/runners/lib/assets/vibecheck-logo.png +0 -0
  5. package/bin/runners/lib/contracts/auth-contract.js +8 -0
  6. package/bin/runners/lib/contracts/env-contract.js +3 -0
  7. package/bin/runners/lib/contracts/external-contract.js +10 -2
  8. package/bin/runners/lib/contracts/route-contract.js +7 -0
  9. package/bin/runners/lib/contracts.js +804 -0
  10. package/bin/runners/lib/detectors-v2.js +703 -0
  11. package/bin/runners/lib/drift.js +425 -0
  12. package/bin/runners/lib/entitlements-v2.js +3 -1
  13. package/bin/runners/lib/entitlements.js +11 -3
  14. package/bin/runners/lib/env-resolver.js +417 -0
  15. package/bin/runners/lib/extractors/client-calls.js +990 -0
  16. package/bin/runners/lib/extractors/fastify-route-dump.js +573 -0
  17. package/bin/runners/lib/extractors/fastify-routes.js +426 -0
  18. package/bin/runners/lib/extractors/index.js +363 -0
  19. package/bin/runners/lib/extractors/next-routes.js +524 -0
  20. package/bin/runners/lib/extractors/proof-graph.js +431 -0
  21. package/bin/runners/lib/extractors/route-matcher.js +451 -0
  22. package/bin/runners/lib/extractors/truthpack-v2.js +377 -0
  23. package/bin/runners/lib/extractors/ui-bindings.js +547 -0
  24. package/bin/runners/lib/findings-schema.js +281 -0
  25. package/bin/runners/lib/html-report.js +650 -0
  26. package/bin/runners/lib/missions/templates.js +45 -0
  27. package/bin/runners/lib/policy.js +295 -0
  28. package/bin/runners/lib/reality/correlation-detectors.js +359 -0
  29. package/bin/runners/lib/reality/index.js +318 -0
  30. package/bin/runners/lib/reality/request-hashing.js +416 -0
  31. package/bin/runners/lib/reality/request-mapper.js +453 -0
  32. package/bin/runners/lib/reality/safety-rails.js +463 -0
  33. package/bin/runners/lib/reality/semantic-snapshot.js +408 -0
  34. package/bin/runners/lib/reality/toast-detector.js +393 -0
  35. package/bin/runners/lib/report-html.js +5 -0
  36. package/bin/runners/lib/report-templates.js +5 -0
  37. package/bin/runners/lib/report.js +135 -0
  38. package/bin/runners/lib/route-truth.js +10 -10
  39. package/bin/runners/lib/schema-validator.js +350 -0
  40. package/bin/runners/lib/schemas/contracts.schema.json +160 -0
  41. package/bin/runners/lib/schemas/finding.schema.json +100 -0
  42. package/bin/runners/lib/schemas/mission-pack.schema.json +206 -0
  43. package/bin/runners/lib/schemas/proof-graph.schema.json +176 -0
  44. package/bin/runners/lib/schemas/reality-report.schema.json +162 -0
  45. package/bin/runners/lib/schemas/share-pack.schema.json +180 -0
  46. package/bin/runners/lib/schemas/ship-report.schema.json +117 -0
  47. package/bin/runners/lib/schemas/truthpack-v2.schema.json +303 -0
  48. package/bin/runners/lib/schemas/validator.js +438 -0
  49. package/bin/runners/lib/ui.js +562 -0
  50. package/bin/runners/lib/verdict-engine.js +628 -0
  51. package/bin/runners/runAIAgent.js +228 -1
  52. package/bin/runners/runBadge.js +181 -1
  53. package/bin/runners/runCtx.js +7 -2
  54. package/bin/runners/runCtxDiff.js +301 -0
  55. package/bin/runners/runGuard.js +168 -0
  56. package/bin/runners/runInitGha.js +78 -15
  57. package/bin/runners/runLabs.js +341 -0
  58. package/bin/runners/runLaunch.js +180 -1
  59. package/bin/runners/runMdc.js +203 -1
  60. package/bin/runners/runProof.zip +0 -0
  61. package/bin/runners/runProve.js +23 -0
  62. package/bin/runners/runReplay.js +114 -84
  63. package/bin/runners/runScan.js +111 -32
  64. package/bin/runners/runShip.js +23 -2
  65. package/bin/runners/runTruthpack.js +9 -7
  66. package/bin/runners/runValidate.js +161 -1
  67. package/bin/vibecheck.js +416 -770
  68. package/mcp-server/.guardrail/audit/audit.log.jsonl +2 -0
  69. package/mcp-server/.specs/architecture.mdc +90 -0
  70. package/mcp-server/.specs/security.mdc +30 -0
  71. package/mcp-server/README.md +252 -0
  72. package/mcp-server/agent-checkpoint.js +364 -0
  73. package/mcp-server/architect-tools.js +707 -0
  74. package/mcp-server/audit-mcp.js +206 -0
  75. package/mcp-server/codebase-architect-tools.js +838 -0
  76. package/mcp-server/consolidated-tools.js +804 -0
  77. package/mcp-server/hygiene-tools.js +428 -0
  78. package/mcp-server/index-v1.js +698 -0
  79. package/mcp-server/index.js +2092 -0
  80. package/mcp-server/index.old.js +4137 -0
  81. package/mcp-server/intelligence-tools.js +664 -0
  82. package/mcp-server/intent-drift-tools.js +873 -0
  83. package/mcp-server/mdc-generator.js +298 -0
  84. package/mcp-server/package-lock.json +165 -0
  85. package/mcp-server/package.json +47 -0
  86. package/mcp-server/premium-tools.js +1275 -0
  87. package/mcp-server/test-mcp.js +108 -0
  88. package/mcp-server/test-tools.js +36 -0
  89. package/mcp-server/tier-auth.js +147 -0
  90. package/mcp-server/tools/index.js +72 -0
  91. package/mcp-server/tools-reorganized.ts +244 -0
  92. package/mcp-server/truth-context.js +581 -0
  93. package/mcp-server/truth-firewall-tools.js +1500 -0
  94. package/mcp-server/vibecheck-2.0-tools.js +748 -0
  95. package/mcp-server/vibecheck-tools.js +1075 -0
  96. package/package.json +10 -8
  97. package/bin/guardrail.js +0 -834
  98. package/bin/runners/runAudit.js +0 -2
  99. package/bin/runners/runAutopilot.js +0 -2
  100. package/bin/runners/runCertify.js +0 -2
  101. package/bin/runners/runDashboard.js +0 -10
  102. package/bin/runners/runEnhancedShip.js +0 -2
  103. package/bin/runners/runFixPacks.js +0 -2
  104. package/bin/runners/runNaturalLanguage.js +0 -3
  105. package/bin/runners/runProof.js +0 -2
  106. package/bin/runners/runRealitySniff.js +0 -2
  107. package/bin/runners/runUpgrade.js +0 -2
  108. package/bin/runners/runVerifyAgentOutput.js +0 -2
@@ -0,0 +1,364 @@
1
+ /**
2
+ * Agent Vibechecks - MCP Server Integration
3
+ *
4
+ * This MCP tool intercepts file writes from AI agents and validates
5
+ * them against checkpoint rules BEFORE the write happens.
6
+ *
7
+ * When an agent (Cursor, Windsurf, etc.) tries to write code,
8
+ * this tool validates it first and blocks if violations found.
9
+ */
10
+
11
+ import fs from "fs";
12
+ import path from "path";
13
+
14
+ // Strictness level rules
15
+ const STRICTNESS_LEVELS = ["chill", "standard", "strict", "paranoid"];
16
+
17
+ // Built-in checkpoint rules
18
+ const CHECKPOINT_RULES = {
19
+ chill: [
20
+ {
21
+ id: "no-todo",
22
+ pattern: /\/\/\s*TODO[:\s].*$/gim,
23
+ message: "TODO comment - complete before moving on",
24
+ block: true,
25
+ },
26
+ {
27
+ id: "no-fixme",
28
+ pattern: /\/\/\s*FIXME[:\s].*$/gim,
29
+ message: "FIXME comment - fix it now",
30
+ block: true,
31
+ },
32
+ {
33
+ id: "no-mock-data",
34
+ pattern:
35
+ /(?:const|let|var)\s+(?:mock|fake|dummy|sample)(?:Data|Users?|Items?)\s*=/gi,
36
+ message: "Mock data detected",
37
+ block: true,
38
+ },
39
+ {
40
+ id: "no-placeholder",
41
+ pattern: /['"`](?:TODO|PLACEHOLDER|REPLACE_ME|CHANGEME|XXX)['"`]/gi,
42
+ message: "Placeholder string",
43
+ block: true,
44
+ },
45
+ {
46
+ id: "no-lorem",
47
+ pattern: /lorem\s+ipsum/gi,
48
+ message: "Lorem ipsum placeholder",
49
+ block: true,
50
+ },
51
+ ],
52
+ standard: [
53
+ {
54
+ id: "no-console-log",
55
+ pattern: /console\.log\s*\(/g,
56
+ message: "console.log - remove or use proper logging",
57
+ block: true,
58
+ },
59
+ {
60
+ id: "no-debugger",
61
+ pattern: /\bdebugger\b/g,
62
+ message: "debugger statement",
63
+ block: true,
64
+ },
65
+ {
66
+ id: "no-localhost",
67
+ pattern: /['"`]https?:\/\/localhost[:\d]*[^'"`]*['"`]/g,
68
+ message: "Hardcoded localhost",
69
+ block: true,
70
+ },
71
+ {
72
+ id: "no-empty-catch",
73
+ pattern: /catch\s*\([^)]*\)\s*\{\s*\}/g,
74
+ message: "Empty catch block",
75
+ block: true,
76
+ },
77
+ ],
78
+ strict: [
79
+ {
80
+ id: "no-any",
81
+ pattern: /:\s*any\b/g,
82
+ message: "any type - use proper TypeScript type",
83
+ block: true,
84
+ },
85
+ {
86
+ id: "no-ts-ignore",
87
+ pattern: /@ts-ignore/g,
88
+ message: "@ts-ignore - fix the type error",
89
+ block: true,
90
+ },
91
+ {
92
+ id: "no-eslint-disable",
93
+ pattern: /eslint-disable/g,
94
+ message: "ESLint disabled - fix the lint error",
95
+ block: true,
96
+ },
97
+ ],
98
+ paranoid: [
99
+ {
100
+ id: "no-nested-ternary",
101
+ pattern: /\?[^:]+\?[^:]+:/g,
102
+ message: "Nested ternary - use if/else",
103
+ block: true,
104
+ },
105
+ {
106
+ id: "no-inline-styles",
107
+ pattern: /style\s*=\s*\{\s*\{/g,
108
+ message: "Inline styles - use CSS",
109
+ block: false,
110
+ },
111
+ ],
112
+ };
113
+
114
+ // Current state
115
+ let currentStrictness = "standard";
116
+ let blockedFiles = new Map();
117
+ let stats = { checked: 0, blocked: 0, passed: 0 };
118
+
119
+ /**
120
+ * Get all rules for a strictness level (includes all lower levels)
121
+ */
122
+ function getRulesForLevel(level) {
123
+ const levelIndex = STRICTNESS_LEVELS.indexOf(level);
124
+ let rules = [];
125
+
126
+ for (let i = 0; i <= levelIndex; i++) {
127
+ const levelRules = CHECKPOINT_RULES[STRICTNESS_LEVELS[i]] || [];
128
+ rules = [...rules, ...levelRules];
129
+ }
130
+
131
+ return rules;
132
+ }
133
+
134
+ /**
135
+ * Validate content against checkpoint rules
136
+ */
137
+ function validateContent(filePath, content) {
138
+ const rules = getRulesForLevel(currentStrictness);
139
+ const violations = [];
140
+ const lines = content.split("\n");
141
+
142
+ for (const rule of rules) {
143
+ rule.pattern.lastIndex = 0;
144
+ let match;
145
+
146
+ while ((match = rule.pattern.exec(content)) !== null) {
147
+ const beforeMatch = content.substring(0, match.index);
148
+ const lineNumber = beforeMatch.split("\n").length;
149
+ const line = lines[lineNumber - 1] || "";
150
+
151
+ // Check for ignore directive
152
+ if (line.includes("@vibecheck-ignore")) continue;
153
+
154
+ violations.push({
155
+ rule: rule.id,
156
+ message: rule.message,
157
+ line: lineNumber,
158
+ code: line.trim(),
159
+ block: rule.block,
160
+ });
161
+
162
+ if (match[0].length === 0) break;
163
+ }
164
+ }
165
+
166
+ return violations;
167
+ }
168
+
169
+ /**
170
+ * Format violations for output
171
+ */
172
+ function formatViolations(filePath, violations) {
173
+ const blockers = violations.filter((v) => v.block);
174
+
175
+ if (blockers.length === 0) {
176
+ return { blocked: false, message: "āœ… Checkpoint passed" };
177
+ }
178
+
179
+ let output = "\nšŸ›‘ CHECKPOINT BLOCKED\n";
180
+ output += "═".repeat(50) + "\n";
181
+ output += `File: ${filePath}\n\n`;
182
+
183
+ for (const v of blockers) {
184
+ output += ` āŒ Line ${v.line}: ${v.message}\n`;
185
+ output += ` ${v.code}\n\n`;
186
+ }
187
+
188
+ output += "═".repeat(50) + "\n";
189
+ output += "Fix these issues before proceeding.\n";
190
+
191
+ return { blocked: true, message: output };
192
+ }
193
+
194
+ /**
195
+ * MCP Tool Definitions for Agent Vibechecks
196
+ */
197
+ const AGENT_CHECKPOINT_TOOLS = [
198
+ {
199
+ name: "vibecheck_checkpoint",
200
+ description: `šŸ›”ļø AGENT CHECKPOINT - Validates code before writing.
201
+
202
+ IMPORTANT: Call this tool BEFORE writing any code to check for:
203
+ - TODOs, FIXMEs that must be completed
204
+ - Mock/placeholder data that must be replaced
205
+ - console.log/debugger statements
206
+ - Type errors (any, @ts-ignore)
207
+
208
+ If this returns blocked=true, you MUST fix the issues before proceeding.
209
+ Do NOT skip this checkpoint.`,
210
+ inputSchema: {
211
+ type: "object",
212
+ properties: {
213
+ file_path: {
214
+ type: "string",
215
+ description: "Path to the file being written",
216
+ },
217
+ content: {
218
+ type: "string",
219
+ description: "The content to validate",
220
+ },
221
+ strictness: {
222
+ type: "string",
223
+ enum: ["chill", "standard", "strict", "paranoid"],
224
+ description: "Validation strictness level (default: standard)",
225
+ },
226
+ },
227
+ required: ["file_path", "content"],
228
+ },
229
+ },
230
+ {
231
+ name: "vibecheck_set_strictness",
232
+ description: `Set the checkpoint strictness level:
233
+ - chill: TODOs, FIXMEs, mock data, placeholders
234
+ - standard: + console.log, debugger, localhost URLs
235
+ - strict: + any types, @ts-ignore, eslint-disable
236
+ - paranoid: + nested ternaries, inline styles`,
237
+ inputSchema: {
238
+ type: "object",
239
+ properties: {
240
+ level: {
241
+ type: "string",
242
+ enum: ["chill", "standard", "strict", "paranoid"],
243
+ description: "The strictness level",
244
+ },
245
+ },
246
+ required: ["level"],
247
+ },
248
+ },
249
+ {
250
+ name: "vibecheck_checkpoint_status",
251
+ description: "Get current checkpoint status and any blocking violations",
252
+ inputSchema: {
253
+ type: "object",
254
+ properties: {},
255
+ },
256
+ },
257
+ ];
258
+
259
+ /**
260
+ * Handle MCP tool calls
261
+ */
262
+ async function handleCheckpointTool(name, args) {
263
+ switch (name) {
264
+ case "vibecheck_checkpoint": {
265
+ const { file_path, content, strictness } = args;
266
+
267
+ if (strictness) {
268
+ currentStrictness = strictness;
269
+ }
270
+
271
+ stats.checked++;
272
+ const violations = validateContent(file_path, content);
273
+ const result = formatViolations(file_path, violations);
274
+
275
+ if (result.blocked) {
276
+ stats.blocked++;
277
+ blockedFiles.set(file_path, violations);
278
+
279
+ return {
280
+ content: [
281
+ {
282
+ type: "text",
283
+ text: result.message,
284
+ },
285
+ ],
286
+ isError: true, // Signal to agent this is a blocker
287
+ };
288
+ }
289
+
290
+ stats.passed++;
291
+ blockedFiles.delete(file_path);
292
+
293
+ return {
294
+ content: [
295
+ {
296
+ type: "text",
297
+ text: `āœ… Checkpoint PASSED for ${file_path}\n\nYou may proceed with writing this file.`,
298
+ },
299
+ ],
300
+ };
301
+ }
302
+
303
+ case "vibecheck_set_strictness": {
304
+ const { level } = args;
305
+ currentStrictness = level;
306
+
307
+ return {
308
+ content: [
309
+ {
310
+ type: "text",
311
+ text: `šŸ›”ļø Checkpoint strictness set to: ${level.toUpperCase()}\n\nActive rules:\n${getRulesForLevel(
312
+ level,
313
+ )
314
+ .map((r) => `- ${r.id}: ${r.message}`)
315
+ .join("\n")}`,
316
+ },
317
+ ],
318
+ };
319
+ }
320
+
321
+ case "vibecheck_checkpoint_status": {
322
+ const blockedList = Array.from(blockedFiles.entries());
323
+
324
+ let status = `šŸ›”ļø Agent Vibechecks Status\n`;
325
+ status += `═══════════════════════════\n`;
326
+ status += `Strictness: ${currentStrictness.toUpperCase()}\n`;
327
+ status += `Files checked: ${stats.checked}\n`;
328
+ status += `Passed: ${stats.passed}\n`;
329
+ status += `Blocked: ${stats.blocked}\n\n`;
330
+
331
+ if (blockedList.length > 0) {
332
+ status += `āš ļø Currently blocked files:\n`;
333
+ for (const [file, violations] of blockedList) {
334
+ status += `\nšŸ“„ ${file}\n`;
335
+ for (const v of violations.filter((v) => v.block)) {
336
+ status += ` Line ${v.line}: ${v.message}\n`;
337
+ }
338
+ }
339
+ } else {
340
+ status += `āœ… No blocked files - all clear!\n`;
341
+ }
342
+
343
+ return {
344
+ content: [{ type: "text", text: status }],
345
+ };
346
+ }
347
+
348
+ default:
349
+ return {
350
+ content: [{ type: "text", text: `Unknown tool: ${name}` }],
351
+ isError: true,
352
+ };
353
+ }
354
+ }
355
+
356
+ export {
357
+ AGENT_CHECKPOINT_TOOLS,
358
+ handleCheckpointTool,
359
+ validateContent,
360
+ formatViolations,
361
+ getRulesForLevel,
362
+ CHECKPOINT_RULES,
363
+ STRICTNESS_LEVELS,
364
+ };