@vibecheckai/cli 3.0.4 ā 3.0.7
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/bin/dev/run-v2-torture.js +30 -0
- package/bin/runners/context/index.js +1 -1
- package/bin/runners/lib/analyzers.js +38 -0
- package/bin/runners/lib/assets/vibecheck-logo.png +0 -0
- package/bin/runners/lib/contracts/auth-contract.js +8 -0
- package/bin/runners/lib/contracts/env-contract.js +3 -0
- package/bin/runners/lib/contracts/external-contract.js +10 -2
- package/bin/runners/lib/contracts/route-contract.js +7 -0
- package/bin/runners/lib/contracts.js +804 -0
- package/bin/runners/lib/detectors-v2.js +703 -0
- package/bin/runners/lib/drift.js +425 -0
- package/bin/runners/lib/entitlements-v2.js +3 -1
- package/bin/runners/lib/entitlements.js +11 -3
- package/bin/runners/lib/env-resolver.js +417 -0
- package/bin/runners/lib/extractors/client-calls.js +990 -0
- package/bin/runners/lib/extractors/fastify-route-dump.js +573 -0
- package/bin/runners/lib/extractors/fastify-routes.js +426 -0
- package/bin/runners/lib/extractors/index.js +363 -0
- package/bin/runners/lib/extractors/next-routes.js +524 -0
- package/bin/runners/lib/extractors/proof-graph.js +431 -0
- package/bin/runners/lib/extractors/route-matcher.js +451 -0
- package/bin/runners/lib/extractors/truthpack-v2.js +377 -0
- package/bin/runners/lib/extractors/ui-bindings.js +547 -0
- package/bin/runners/lib/findings-schema.js +281 -0
- package/bin/runners/lib/html-report.js +650 -0
- package/bin/runners/lib/missions/templates.js +45 -0
- package/bin/runners/lib/policy.js +295 -0
- package/bin/runners/lib/reality/correlation-detectors.js +359 -0
- package/bin/runners/lib/reality/index.js +318 -0
- package/bin/runners/lib/reality/request-hashing.js +416 -0
- package/bin/runners/lib/reality/request-mapper.js +453 -0
- package/bin/runners/lib/reality/safety-rails.js +463 -0
- package/bin/runners/lib/reality/semantic-snapshot.js +408 -0
- package/bin/runners/lib/reality/toast-detector.js +393 -0
- package/bin/runners/lib/report-html.js +5 -0
- package/bin/runners/lib/report-templates.js +5 -0
- package/bin/runners/lib/report.js +135 -0
- package/bin/runners/lib/route-truth.js +10 -10
- package/bin/runners/lib/schema-validator.js +350 -0
- package/bin/runners/lib/schemas/contracts.schema.json +160 -0
- package/bin/runners/lib/schemas/finding.schema.json +100 -0
- package/bin/runners/lib/schemas/mission-pack.schema.json +206 -0
- package/bin/runners/lib/schemas/proof-graph.schema.json +176 -0
- package/bin/runners/lib/schemas/reality-report.schema.json +162 -0
- package/bin/runners/lib/schemas/share-pack.schema.json +180 -0
- package/bin/runners/lib/schemas/ship-report.schema.json +117 -0
- package/bin/runners/lib/schemas/truthpack-v2.schema.json +303 -0
- package/bin/runners/lib/schemas/validator.js +438 -0
- package/bin/runners/lib/ui.js +562 -0
- package/bin/runners/lib/verdict-engine.js +628 -0
- package/bin/runners/runAIAgent.js +228 -1
- package/bin/runners/runBadge.js +181 -1
- package/bin/runners/runCtx.js +7 -2
- package/bin/runners/runCtxDiff.js +301 -0
- package/bin/runners/runGuard.js +168 -0
- package/bin/runners/runInitGha.js +78 -15
- package/bin/runners/runLabs.js +341 -0
- package/bin/runners/runLaunch.js +180 -1
- package/bin/runners/runMdc.js +203 -1
- package/bin/runners/runProof.zip +0 -0
- package/bin/runners/runProve.js +23 -0
- package/bin/runners/runReplay.js +114 -84
- package/bin/runners/runScan.js +111 -32
- package/bin/runners/runShip.js +23 -2
- package/bin/runners/runTruthpack.js +9 -7
- package/bin/runners/runValidate.js +161 -1
- package/bin/vibecheck.js +416 -770
- package/mcp-server/.guardrail/audit/audit.log.jsonl +2 -0
- package/mcp-server/.specs/architecture.mdc +90 -0
- package/mcp-server/.specs/security.mdc +30 -0
- package/mcp-server/README.md +252 -0
- package/mcp-server/agent-checkpoint.js +364 -0
- package/mcp-server/architect-tools.js +707 -0
- package/mcp-server/audit-mcp.js +206 -0
- package/mcp-server/codebase-architect-tools.js +838 -0
- package/mcp-server/consolidated-tools.js +804 -0
- package/mcp-server/hygiene-tools.js +428 -0
- package/mcp-server/index-v1.js +698 -0
- package/mcp-server/index.js +2092 -0
- package/mcp-server/index.old.js +4137 -0
- package/mcp-server/intelligence-tools.js +664 -0
- package/mcp-server/intent-drift-tools.js +873 -0
- package/mcp-server/mdc-generator.js +298 -0
- package/mcp-server/package-lock.json +165 -0
- package/mcp-server/package.json +47 -0
- package/mcp-server/premium-tools.js +1275 -0
- package/mcp-server/test-mcp.js +108 -0
- package/mcp-server/test-tools.js +36 -0
- package/mcp-server/tier-auth.js +147 -0
- package/mcp-server/tools/index.js +72 -0
- package/mcp-server/tools-reorganized.ts +244 -0
- package/mcp-server/truth-context.js +581 -0
- package/mcp-server/truth-firewall-tools.js +1500 -0
- package/mcp-server/vibecheck-2.0-tools.js +748 -0
- package/mcp-server/vibecheck-tools.js +1075 -0
- package/package.json +10 -8
- package/bin/guardrail.js +0 -834
- package/bin/runners/runAudit.js +0 -2
- package/bin/runners/runAutopilot.js +0 -2
- package/bin/runners/runCertify.js +0 -2
- package/bin/runners/runDashboard.js +0 -10
- package/bin/runners/runEnhancedShip.js +0 -2
- package/bin/runners/runFixPacks.js +0 -2
- package/bin/runners/runNaturalLanguage.js +0 -3
- package/bin/runners/runProof.js +0 -2
- package/bin/runners/runRealitySniff.js +0 -2
- package/bin/runners/runUpgrade.js +0 -2
- package/bin/runners/runVerifyAgentOutput.js +0 -2
|
@@ -0,0 +1,364 @@
|
|
|
1
|
+
/**
|
|
2
|
+
* Agent Vibechecks - MCP Server Integration
|
|
3
|
+
*
|
|
4
|
+
* This MCP tool intercepts file writes from AI agents and validates
|
|
5
|
+
* them against checkpoint rules BEFORE the write happens.
|
|
6
|
+
*
|
|
7
|
+
* When an agent (Cursor, Windsurf, etc.) tries to write code,
|
|
8
|
+
* this tool validates it first and blocks if violations found.
|
|
9
|
+
*/
|
|
10
|
+
|
|
11
|
+
import fs from "fs";
|
|
12
|
+
import path from "path";
|
|
13
|
+
|
|
14
|
+
// Strictness level rules
|
|
15
|
+
const STRICTNESS_LEVELS = ["chill", "standard", "strict", "paranoid"];
|
|
16
|
+
|
|
17
|
+
// Built-in checkpoint rules
|
|
18
|
+
const CHECKPOINT_RULES = {
|
|
19
|
+
chill: [
|
|
20
|
+
{
|
|
21
|
+
id: "no-todo",
|
|
22
|
+
pattern: /\/\/\s*TODO[:\s].*$/gim,
|
|
23
|
+
message: "TODO comment - complete before moving on",
|
|
24
|
+
block: true,
|
|
25
|
+
},
|
|
26
|
+
{
|
|
27
|
+
id: "no-fixme",
|
|
28
|
+
pattern: /\/\/\s*FIXME[:\s].*$/gim,
|
|
29
|
+
message: "FIXME comment - fix it now",
|
|
30
|
+
block: true,
|
|
31
|
+
},
|
|
32
|
+
{
|
|
33
|
+
id: "no-mock-data",
|
|
34
|
+
pattern:
|
|
35
|
+
/(?:const|let|var)\s+(?:mock|fake|dummy|sample)(?:Data|Users?|Items?)\s*=/gi,
|
|
36
|
+
message: "Mock data detected",
|
|
37
|
+
block: true,
|
|
38
|
+
},
|
|
39
|
+
{
|
|
40
|
+
id: "no-placeholder",
|
|
41
|
+
pattern: /['"`](?:TODO|PLACEHOLDER|REPLACE_ME|CHANGEME|XXX)['"`]/gi,
|
|
42
|
+
message: "Placeholder string",
|
|
43
|
+
block: true,
|
|
44
|
+
},
|
|
45
|
+
{
|
|
46
|
+
id: "no-lorem",
|
|
47
|
+
pattern: /lorem\s+ipsum/gi,
|
|
48
|
+
message: "Lorem ipsum placeholder",
|
|
49
|
+
block: true,
|
|
50
|
+
},
|
|
51
|
+
],
|
|
52
|
+
standard: [
|
|
53
|
+
{
|
|
54
|
+
id: "no-console-log",
|
|
55
|
+
pattern: /console\.log\s*\(/g,
|
|
56
|
+
message: "console.log - remove or use proper logging",
|
|
57
|
+
block: true,
|
|
58
|
+
},
|
|
59
|
+
{
|
|
60
|
+
id: "no-debugger",
|
|
61
|
+
pattern: /\bdebugger\b/g,
|
|
62
|
+
message: "debugger statement",
|
|
63
|
+
block: true,
|
|
64
|
+
},
|
|
65
|
+
{
|
|
66
|
+
id: "no-localhost",
|
|
67
|
+
pattern: /['"`]https?:\/\/localhost[:\d]*[^'"`]*['"`]/g,
|
|
68
|
+
message: "Hardcoded localhost",
|
|
69
|
+
block: true,
|
|
70
|
+
},
|
|
71
|
+
{
|
|
72
|
+
id: "no-empty-catch",
|
|
73
|
+
pattern: /catch\s*\([^)]*\)\s*\{\s*\}/g,
|
|
74
|
+
message: "Empty catch block",
|
|
75
|
+
block: true,
|
|
76
|
+
},
|
|
77
|
+
],
|
|
78
|
+
strict: [
|
|
79
|
+
{
|
|
80
|
+
id: "no-any",
|
|
81
|
+
pattern: /:\s*any\b/g,
|
|
82
|
+
message: "any type - use proper TypeScript type",
|
|
83
|
+
block: true,
|
|
84
|
+
},
|
|
85
|
+
{
|
|
86
|
+
id: "no-ts-ignore",
|
|
87
|
+
pattern: /@ts-ignore/g,
|
|
88
|
+
message: "@ts-ignore - fix the type error",
|
|
89
|
+
block: true,
|
|
90
|
+
},
|
|
91
|
+
{
|
|
92
|
+
id: "no-eslint-disable",
|
|
93
|
+
pattern: /eslint-disable/g,
|
|
94
|
+
message: "ESLint disabled - fix the lint error",
|
|
95
|
+
block: true,
|
|
96
|
+
},
|
|
97
|
+
],
|
|
98
|
+
paranoid: [
|
|
99
|
+
{
|
|
100
|
+
id: "no-nested-ternary",
|
|
101
|
+
pattern: /\?[^:]+\?[^:]+:/g,
|
|
102
|
+
message: "Nested ternary - use if/else",
|
|
103
|
+
block: true,
|
|
104
|
+
},
|
|
105
|
+
{
|
|
106
|
+
id: "no-inline-styles",
|
|
107
|
+
pattern: /style\s*=\s*\{\s*\{/g,
|
|
108
|
+
message: "Inline styles - use CSS",
|
|
109
|
+
block: false,
|
|
110
|
+
},
|
|
111
|
+
],
|
|
112
|
+
};
|
|
113
|
+
|
|
114
|
+
// Current state
|
|
115
|
+
let currentStrictness = "standard";
|
|
116
|
+
let blockedFiles = new Map();
|
|
117
|
+
let stats = { checked: 0, blocked: 0, passed: 0 };
|
|
118
|
+
|
|
119
|
+
/**
|
|
120
|
+
* Get all rules for a strictness level (includes all lower levels)
|
|
121
|
+
*/
|
|
122
|
+
function getRulesForLevel(level) {
|
|
123
|
+
const levelIndex = STRICTNESS_LEVELS.indexOf(level);
|
|
124
|
+
let rules = [];
|
|
125
|
+
|
|
126
|
+
for (let i = 0; i <= levelIndex; i++) {
|
|
127
|
+
const levelRules = CHECKPOINT_RULES[STRICTNESS_LEVELS[i]] || [];
|
|
128
|
+
rules = [...rules, ...levelRules];
|
|
129
|
+
}
|
|
130
|
+
|
|
131
|
+
return rules;
|
|
132
|
+
}
|
|
133
|
+
|
|
134
|
+
/**
|
|
135
|
+
* Validate content against checkpoint rules
|
|
136
|
+
*/
|
|
137
|
+
function validateContent(filePath, content) {
|
|
138
|
+
const rules = getRulesForLevel(currentStrictness);
|
|
139
|
+
const violations = [];
|
|
140
|
+
const lines = content.split("\n");
|
|
141
|
+
|
|
142
|
+
for (const rule of rules) {
|
|
143
|
+
rule.pattern.lastIndex = 0;
|
|
144
|
+
let match;
|
|
145
|
+
|
|
146
|
+
while ((match = rule.pattern.exec(content)) !== null) {
|
|
147
|
+
const beforeMatch = content.substring(0, match.index);
|
|
148
|
+
const lineNumber = beforeMatch.split("\n").length;
|
|
149
|
+
const line = lines[lineNumber - 1] || "";
|
|
150
|
+
|
|
151
|
+
// Check for ignore directive
|
|
152
|
+
if (line.includes("@vibecheck-ignore")) continue;
|
|
153
|
+
|
|
154
|
+
violations.push({
|
|
155
|
+
rule: rule.id,
|
|
156
|
+
message: rule.message,
|
|
157
|
+
line: lineNumber,
|
|
158
|
+
code: line.trim(),
|
|
159
|
+
block: rule.block,
|
|
160
|
+
});
|
|
161
|
+
|
|
162
|
+
if (match[0].length === 0) break;
|
|
163
|
+
}
|
|
164
|
+
}
|
|
165
|
+
|
|
166
|
+
return violations;
|
|
167
|
+
}
|
|
168
|
+
|
|
169
|
+
/**
|
|
170
|
+
* Format violations for output
|
|
171
|
+
*/
|
|
172
|
+
function formatViolations(filePath, violations) {
|
|
173
|
+
const blockers = violations.filter((v) => v.block);
|
|
174
|
+
|
|
175
|
+
if (blockers.length === 0) {
|
|
176
|
+
return { blocked: false, message: "ā
Checkpoint passed" };
|
|
177
|
+
}
|
|
178
|
+
|
|
179
|
+
let output = "\nš CHECKPOINT BLOCKED\n";
|
|
180
|
+
output += "ā".repeat(50) + "\n";
|
|
181
|
+
output += `File: ${filePath}\n\n`;
|
|
182
|
+
|
|
183
|
+
for (const v of blockers) {
|
|
184
|
+
output += ` ā Line ${v.line}: ${v.message}\n`;
|
|
185
|
+
output += ` ${v.code}\n\n`;
|
|
186
|
+
}
|
|
187
|
+
|
|
188
|
+
output += "ā".repeat(50) + "\n";
|
|
189
|
+
output += "Fix these issues before proceeding.\n";
|
|
190
|
+
|
|
191
|
+
return { blocked: true, message: output };
|
|
192
|
+
}
|
|
193
|
+
|
|
194
|
+
/**
|
|
195
|
+
* MCP Tool Definitions for Agent Vibechecks
|
|
196
|
+
*/
|
|
197
|
+
const AGENT_CHECKPOINT_TOOLS = [
|
|
198
|
+
{
|
|
199
|
+
name: "vibecheck_checkpoint",
|
|
200
|
+
description: `š”ļø AGENT CHECKPOINT - Validates code before writing.
|
|
201
|
+
|
|
202
|
+
IMPORTANT: Call this tool BEFORE writing any code to check for:
|
|
203
|
+
- TODOs, FIXMEs that must be completed
|
|
204
|
+
- Mock/placeholder data that must be replaced
|
|
205
|
+
- console.log/debugger statements
|
|
206
|
+
- Type errors (any, @ts-ignore)
|
|
207
|
+
|
|
208
|
+
If this returns blocked=true, you MUST fix the issues before proceeding.
|
|
209
|
+
Do NOT skip this checkpoint.`,
|
|
210
|
+
inputSchema: {
|
|
211
|
+
type: "object",
|
|
212
|
+
properties: {
|
|
213
|
+
file_path: {
|
|
214
|
+
type: "string",
|
|
215
|
+
description: "Path to the file being written",
|
|
216
|
+
},
|
|
217
|
+
content: {
|
|
218
|
+
type: "string",
|
|
219
|
+
description: "The content to validate",
|
|
220
|
+
},
|
|
221
|
+
strictness: {
|
|
222
|
+
type: "string",
|
|
223
|
+
enum: ["chill", "standard", "strict", "paranoid"],
|
|
224
|
+
description: "Validation strictness level (default: standard)",
|
|
225
|
+
},
|
|
226
|
+
},
|
|
227
|
+
required: ["file_path", "content"],
|
|
228
|
+
},
|
|
229
|
+
},
|
|
230
|
+
{
|
|
231
|
+
name: "vibecheck_set_strictness",
|
|
232
|
+
description: `Set the checkpoint strictness level:
|
|
233
|
+
- chill: TODOs, FIXMEs, mock data, placeholders
|
|
234
|
+
- standard: + console.log, debugger, localhost URLs
|
|
235
|
+
- strict: + any types, @ts-ignore, eslint-disable
|
|
236
|
+
- paranoid: + nested ternaries, inline styles`,
|
|
237
|
+
inputSchema: {
|
|
238
|
+
type: "object",
|
|
239
|
+
properties: {
|
|
240
|
+
level: {
|
|
241
|
+
type: "string",
|
|
242
|
+
enum: ["chill", "standard", "strict", "paranoid"],
|
|
243
|
+
description: "The strictness level",
|
|
244
|
+
},
|
|
245
|
+
},
|
|
246
|
+
required: ["level"],
|
|
247
|
+
},
|
|
248
|
+
},
|
|
249
|
+
{
|
|
250
|
+
name: "vibecheck_checkpoint_status",
|
|
251
|
+
description: "Get current checkpoint status and any blocking violations",
|
|
252
|
+
inputSchema: {
|
|
253
|
+
type: "object",
|
|
254
|
+
properties: {},
|
|
255
|
+
},
|
|
256
|
+
},
|
|
257
|
+
];
|
|
258
|
+
|
|
259
|
+
/**
|
|
260
|
+
* Handle MCP tool calls
|
|
261
|
+
*/
|
|
262
|
+
async function handleCheckpointTool(name, args) {
|
|
263
|
+
switch (name) {
|
|
264
|
+
case "vibecheck_checkpoint": {
|
|
265
|
+
const { file_path, content, strictness } = args;
|
|
266
|
+
|
|
267
|
+
if (strictness) {
|
|
268
|
+
currentStrictness = strictness;
|
|
269
|
+
}
|
|
270
|
+
|
|
271
|
+
stats.checked++;
|
|
272
|
+
const violations = validateContent(file_path, content);
|
|
273
|
+
const result = formatViolations(file_path, violations);
|
|
274
|
+
|
|
275
|
+
if (result.blocked) {
|
|
276
|
+
stats.blocked++;
|
|
277
|
+
blockedFiles.set(file_path, violations);
|
|
278
|
+
|
|
279
|
+
return {
|
|
280
|
+
content: [
|
|
281
|
+
{
|
|
282
|
+
type: "text",
|
|
283
|
+
text: result.message,
|
|
284
|
+
},
|
|
285
|
+
],
|
|
286
|
+
isError: true, // Signal to agent this is a blocker
|
|
287
|
+
};
|
|
288
|
+
}
|
|
289
|
+
|
|
290
|
+
stats.passed++;
|
|
291
|
+
blockedFiles.delete(file_path);
|
|
292
|
+
|
|
293
|
+
return {
|
|
294
|
+
content: [
|
|
295
|
+
{
|
|
296
|
+
type: "text",
|
|
297
|
+
text: `ā
Checkpoint PASSED for ${file_path}\n\nYou may proceed with writing this file.`,
|
|
298
|
+
},
|
|
299
|
+
],
|
|
300
|
+
};
|
|
301
|
+
}
|
|
302
|
+
|
|
303
|
+
case "vibecheck_set_strictness": {
|
|
304
|
+
const { level } = args;
|
|
305
|
+
currentStrictness = level;
|
|
306
|
+
|
|
307
|
+
return {
|
|
308
|
+
content: [
|
|
309
|
+
{
|
|
310
|
+
type: "text",
|
|
311
|
+
text: `š”ļø Checkpoint strictness set to: ${level.toUpperCase()}\n\nActive rules:\n${getRulesForLevel(
|
|
312
|
+
level,
|
|
313
|
+
)
|
|
314
|
+
.map((r) => `- ${r.id}: ${r.message}`)
|
|
315
|
+
.join("\n")}`,
|
|
316
|
+
},
|
|
317
|
+
],
|
|
318
|
+
};
|
|
319
|
+
}
|
|
320
|
+
|
|
321
|
+
case "vibecheck_checkpoint_status": {
|
|
322
|
+
const blockedList = Array.from(blockedFiles.entries());
|
|
323
|
+
|
|
324
|
+
let status = `š”ļø Agent Vibechecks Status\n`;
|
|
325
|
+
status += `āāāāāāāāāāāāāāāāāāāāāāāāāāā\n`;
|
|
326
|
+
status += `Strictness: ${currentStrictness.toUpperCase()}\n`;
|
|
327
|
+
status += `Files checked: ${stats.checked}\n`;
|
|
328
|
+
status += `Passed: ${stats.passed}\n`;
|
|
329
|
+
status += `Blocked: ${stats.blocked}\n\n`;
|
|
330
|
+
|
|
331
|
+
if (blockedList.length > 0) {
|
|
332
|
+
status += `ā ļø Currently blocked files:\n`;
|
|
333
|
+
for (const [file, violations] of blockedList) {
|
|
334
|
+
status += `\nš ${file}\n`;
|
|
335
|
+
for (const v of violations.filter((v) => v.block)) {
|
|
336
|
+
status += ` Line ${v.line}: ${v.message}\n`;
|
|
337
|
+
}
|
|
338
|
+
}
|
|
339
|
+
} else {
|
|
340
|
+
status += `ā
No blocked files - all clear!\n`;
|
|
341
|
+
}
|
|
342
|
+
|
|
343
|
+
return {
|
|
344
|
+
content: [{ type: "text", text: status }],
|
|
345
|
+
};
|
|
346
|
+
}
|
|
347
|
+
|
|
348
|
+
default:
|
|
349
|
+
return {
|
|
350
|
+
content: [{ type: "text", text: `Unknown tool: ${name}` }],
|
|
351
|
+
isError: true,
|
|
352
|
+
};
|
|
353
|
+
}
|
|
354
|
+
}
|
|
355
|
+
|
|
356
|
+
export {
|
|
357
|
+
AGENT_CHECKPOINT_TOOLS,
|
|
358
|
+
handleCheckpointTool,
|
|
359
|
+
validateContent,
|
|
360
|
+
formatViolations,
|
|
361
|
+
getRulesForLevel,
|
|
362
|
+
CHECKPOINT_RULES,
|
|
363
|
+
STRICTNESS_LEVELS,
|
|
364
|
+
};
|